topic Re: TLS trusted-host in Network Security

TLS trusted-host

vpoole — Sun, 10 Mar 2019 09:34:18 GMT

Certificate on IDSM Console expired. Created new certificate, then deleted and add IDS Sensor using discovery. Login to IDS sensor verified clock on matched IDSM Console, then removed trusted-host and re-add to generate new certificate. Cert on sensor doesn't match IDSM Console cert. Still getting TLS trusted host errors when trying to do signature updates. Am I missing a step? Any suggestions? Thanks,

Re: TLS trusted-host

marcabal — Thu, 04 Aug 2005 21:22:47 GMT

If it is the IDSM-2 certificate that expired, then the steps are correct.

My assumption, however, is that the error you are receiving is not because the IDSM-2 certificate has expired, but instead it is the VMS certificate that has expired.

You would need to create a new certificate for the VMS itself. Then go to the sensor and remove the sensor's knowledge of the VMS old certificate and tell it to grab the new VMS certificate.

Here is how you tell the sensor to grab VMS's new certificate:

http://www.cisco.com/univercd/cc/td/doc/product/iaabu/csids/csids11/cliguide/clitasks.htm#wp1036631

I am not sure what the steps are to create a new certificate on the VMS itself.

Re: TLS trusted-host

vpoole — Fri, 05 Aug 2005 11:45:46 GMT

Thanks for your response. I believe you're correct about it being VMS cert. Used keytool -printcert -file ./server.cert to veiw newly created cert, which is now good for 10 years. Already tried your suggestion of removing VMS trusted-host on sensor and then adding it back to create a new cert.

"no TLS trusted-host ip-address 172.16.208.50"

TLS trusted-host ip-address 172.16.208.50"

It adds VMS ip address to trusted host list, but creates a cert that doesn't match new cert, so it's not grabing the new cert from VMS for some reason. I'm wondering if there is a communication problem between sensor and vms host? However, I can delete sensor and then add sensor back using discovery mode without problems. Open to additional suggestions since I'm still at a lost.

Re: TLS trusted-host

brhamon — Mon, 08 Aug 2005 15:44:34 GMT

There was a defect affecting IDS MC versions 2.0 and 2.0.1 that would cause the behavior you are seeing if you are using the CiscoWorks certificate.

If you are running an affected version, go into VPN/Security Management Solution > Administration > Configuration > Certificate. If the "CiscoWorks Certificate" is selected, then this is your problem. The following link provides two workarounds.

http://www.cisco.com/cgi-bin/Support/Bugtool/onebug.pl?bugid=CSCsa53069

Re: TLS trusted-host

vpoole — Mon, 08 Aug 2005 16:05:03 GMT

Thanks for your response. It appears old cert was being cache somewhere. Once I stopped and started crmdmgtd service, sensors were able to grab new cert.